Network Logons with Local Accounts

id: 95a44d0f-b717-4e34-902f-2fad4d6fcbe3
name: Network Logons with Local Accounts
description: |
  This query looks for a large number of network-based authentications using local credentials coming from a single source IP address. High counts of logons involving a large number of distinct machines may identify an attacker beachhead within an enterprise.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceLogonEvents
tactics:
- Lateral movement
query: |
  DeviceLogonEvents
  | where Timestamp > ago(30d)
  | where AccountDomain == DeviceName and isnotempty( RemoteIP) and RemoteIP !in ('::1','-', '0.0.0.0') and RemoteIP !startswith "127."
  | summarize LogonAttempts = count(), DistinctMachines = dcount(DeviceId), Successes = countif(ActionType == 'Success'), RemoteDeviceName = any(RemoteDeviceName)  by RemoteIP, Protocol, LogonType, AccountName
  | order by Successes desc, LogonAttempts desc